The vulnerability stems from improper access control when serving files. Craft CMS's asset management system typically uses controller actions to handle file requests. The AssetsController::actionServeFile method would be responsible for serving files, and in vulnerable versions, it likely did not properly restrict the base directory path validation, allowing traversal into protected craft/app/ folders. This matches the CWE-284 pattern and the described vulnerability impact of exposing sensitive application files.